Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces

Live updates

1. 2h ago

   Attackers Exploit PHP2Shell Flaws in Palo Alto Interfaces

   Threat actors are actively exploiting critical PHP2Shell vulnerabilities against internet-exposed Palo Alto Networks PAN-OS management interfaces. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS scores of 9.2, allow unauthenticated remote code execution on systems running affected PHP versions. Attackers have chained these security gaps with a Linux kernel flaw to gain root privileges on target firewalls. Palo Alto Networks urges organizations to apply security updates and secure management interfaces immediately, as other vendor products may also be affected.

   Why it matters

   The underlying vulnerabilities reside in PHP, a scripting language utilized globally for web servers and content management systems. The PHP Foundation patched the issues upstream on October 21, 2026, across versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. While the campaign has compromised firewalls and targeted servers linked to the United States government, reports indicate that WordPress sites have not been successfully compromised.

   What is confirmed

   • Palo Alto Networks confirmed that threat actors are actively exploiting PHP2Shell vulnerabilities against publicly accessible management interfaces.
   • The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 with CVSS scores of 9.2.
   • The flaws allow attackers to achieve unauthenticated remote code execution on systems running affected versions of PHP.
   • The PHP Foundation patched the upstream issues on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
   • Attackers have chained the PHP2Shell vulnerabilities with a Linux kernel flaw to gain root privileges on PAN-OS systems.

   Still unconfirmed

   • Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers.
   • An AI-enabled campaign hit two dozen targets, including sites linked to the U.S. government.

   What to watch next

   • Additional disclosures from other software vendors affected by PHP2Shell flaws
   • Further telemetry regarding the scope of firewall compromises across government and enterprise networks
   • Updates from security researchers on whether the exploitation campaign expands beyond initial targets
   Sources used for this update (20)

   1. WSJ — AI Hacks Are Coming Thick and Fast and Overwhelming the Internet
   2. BBC — The PHP developer who became the unsung hero of the internet
   3. wiz.io — PHP2Shell: Exploitation Attempts and Remediation Trends
   4. Cloudflare Blog — Introducing the Cloudflare PHP Capture the Flag challenge
   5. The New York Times — Silicon Valley Is Grappling With a Flood of Bugs Found by A.I.
   6. Bloomberg — How AI Is Making Cyberattacks a Bigger Threat
   7. The Hacker News — Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces
   8. Cybersecurity Dive — Insurance industry fears potential impacts from PHP2Shell
   9. The Register — Suspected Chinese attackers built a custom PHP2Shell exploit and rooted 25 servers
   10. CNN — AI is exposing how fragile the web really is. What you can do to stay safe
   11. KATU — Fact Check Team: Is the programming language 'PHP2Shell' putting websites at risk?
   12. unit42.paloaltonetworks.com — Threat Brief: Critical Vulnerabilities in PHP: CVE-2026 ...
   confidence 95%